ET MALWARE Win32/ProtonBot Stealer Activity

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Win32/ProtonBot Stealer Activity";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:".php?id=";
    content:"-"; distance:8; within:1;
    content:"-"; distance:4; within:1;
    content:"-"; distance:4; within:1;
    content:"-"; distance:4; within:1;
    content:"&clip=get"; distance:12; within:9; endswith;
    http.user_agent;
    content:"Proton Browser"; fast_pattern;
    http.header_names;
    content:!"Referer";
    reference:url,fumik0.com/2019/05/24/overview-of-proton-bot-another-loader-in-the-wild;
    reference:md5,efb1db340e78f6799d9fbc5ee08f40fe;
    classtype:trojan-activity;
    sid:2027383; rev:3;
    metadata:created_at 2019_05_28, malware_family ProtonBot, confidence High, signature_severity Major, updated_at 2020_09_17;
)